foglock

Keep passwords out of your config files, and keep the config files in git.

[database]
user = "app"
password = "@enc gAAAAABm9x2k...Q7c="

Secrets are stored encrypted, right where they are used. The key lives in one file on the server, outside the repository. Your app decrypts the values when it reads its settings.

Documentation: foglock.readthedocs.io

• Standard cryptography. Fernet (AES-128-CBC with HMAC-SHA256) from cryptography. Each value gets a random IV, so equal passwords encrypt differently, and a modified value fails loudly instead of decrypting to garbage.
• Works with any format. An encrypted value is just a string starting with @enc , so it fits in TOML, YAML, JSON, INI and .env files alike.
• Key rotation built in. Add a new key, re-encrypt every file in one command, and retire the old key. Old values keep working in between.
• Checks without revealing anything. foglock validate confirms every value on a server decrypts with its key, and prints no secrets.
• Dynaconf support. One call and @enc values decrypt as settings are read.

Install

pip install foglock
pip install "foglock[dynaconf]"   # with Dynaconf integration

Requires Python 3.9 or newer.

Quick start

foglock genkey      # writes ./master.key (mode 0400); keep it out of git
foglock encrypt     # type the secret twice at a hidden prompt

@enc gAAAAABm9x2k...Q7c=

Paste the value into your config, then decrypt it in your app:

from foglock import Foglock

lock = Foglock.from_env()         # finds the key, see below
lock.decrypt(config["database"]["password"])

settings = lock.decrypt_tree(config)   # or decrypt every @enc value at once

With Dynaconf:

from dynaconf import Dynaconf
from foglock.dynaconf import register

register()
settings = Dynaconf(settings_files=["settings.toml"])
settings.database.password   # plain text

Where the key comes from

The first of these that is set wins:

1. --key-file PATH on the command line, or Foglock.from_env("PATH") in code
2. FOGLOCK_KEY: the key itself (comma-separated for several keys), handy in CI
3. FOGLOCK_KEY_FILE: path to the key file, e.g. /etc/myapp/master.key
4. ./master.key

Command line

Rotating the key

foglock genkey --rotate               # master.key now holds the new key and the old one
foglock rotate config/*.toml          # re-encrypt with the new key
foglock validate config/*.toml
# then delete the old key (the last line) from master.key

rotate checks every value before it touches a file, so a value it cannot decrypt leaves all the files as they were.

What it is not

• Not for storing user passwords. Passwords your users log in with must be hashed (argon2, bcrypt, scrypt), never encrypted. foglock is for secrets your app itself has to use, such as database passwords and API tokens.
• Not a secrets manager. There is no server, no access control and no audit log. Anyone who has the key file can read every value. If you need those things, use Vault, AWS Secrets Manager or similar.

License

MIT